Class Action Litigation And The Harm Threshold

More than 150 consumer class actions were filed in 2011 alleging invasions of online privacy. These claims were brought under a mix of state and federal statutes that provide attorney fees and statutory damages. Federal claims were typically brought under the Electronic Communications Privacy Act (ECPA), Computer Fraud and Abuse Act (CFAA), and Stored Communications Act (SCA). State claims typically were brought under consumer protection statutes (e.g., Ch. 93A in Massachusetts), as well as common law theories, such as breach of contract, invasion of privacy and unjust enrichment.

Common fact patterns emerged, and many of these cases alleged the following:

Violations of terms of use agreements Leasing, selling and improper disclosure of personal information from social media websites Improper use of internet browser tracking technologies, e.g., Flash cookies (a cookie that regenerates itself when deleted), browser history sniffing code and online behavioral analysis Common theories of harm included the following:

Increased risk of identity theft Time and effort to monitor/fix credit Emotional distress Personal information as property Despite the large number of invasion of online privacy class actions filed, plaintiffs have struggled to quantify the harm they have suffered. In fact, defendants often prevailed because plaintiffs were unable to plead sufficient economic or emotional harm (e.g., Bose v. Interclick, Low v. LinkedIn, Del Vecchio v. Amazon, In re Facebook Privacy Litigation and Krottner v. Starbucks). For example, in Bose v. Interclick, 2011 U.S. Dist. LEXIS 93663 (SDNY), the court dismissed Bose's class action CFAA claim and held that she failed to show that Interclick, an internet advertising company, caused damage to her "computers, systems or data that could require economic remedy" when it installed a Flash cookie and browser history sniffing code on her personal computer. Interclick's software had gathered and transmitted Bose's browsing habits to an online advertising network. The court reasoned that Bose failed to establish how she was deprived of the economic value of her personal information simply because it was collected by a third party and failed to demonstrate how Interclick's software caused damage, a slowdown or a shutdown to her computer. The court, however, denied...